Beers with Talos Podcast

Cybercriminals are increasingly relying on AI, but in doing so, they're creating an entirely new source of threat intelligence.
This week, Talos researcher Arnaud Zobec joins Hazel, Bill, Joe and Dave to discuss what happens when attackers leave behind AI prompt logs, agent configurations and other unexpected artifacts. From jailbreak attempts to agentic workflows and accidental infrastructure leaks, the team discusses what these artifacts reveal about attacker behavior, and where/how AI is changing offensive operations and campaigns. Here's the link to that blog https://blog.talosintelligence.com/keep-going-bro-youve-got-this-a-data-driven-look-at-how-adversaries-are-weaponizing-ai/
Also in this episode: our listener question tackles the surprising bad actor developments in over the past year, plus a bonus question on walk-on songs officially makes us a music podcast. Bill puts Hazel through her paces with an old school SOC question in 'Make Hazel a hacker'. And Dave leaves everyone with chills.

In this episode of Beers with Talos, Hazel, Bill, Dave and Joe are joined by Kendall McKay to dive into the soap opera of modern cybercrime. From rival gangs launching smear campaigns against one another to reputation systems, trusted intermediaries and dark web "customer reviews". Turns out, every ransomware operation is one passive-aggressive group chat message away from falling apart.
Kendall chats to us about how AI is changing the economics of cybercrime, why it's helping inexperienced attackers get through the front door (only to leave them wondering what to do next), and how defenders can prioritize their defenses.
We also discuss the rise of supply chain attacks, and where the lines between cybercrime and state sponsored activity are beginning to blur.
Elsewhere in the episode, Joe once again attempts to Make Hazel a Hacker, Dave explains how a McDonald's receipt became an unlikely piece of counterintelligence, we preview Black Hat 2026, and Bill wraps everything up with his practical takeaways for defenders.

In this episode of Beers with Talos, Hazel, Bill, Dave and Joe are joined by Talos Security Research Engineer James Nutland to discuss Living Off Trusted Services (LOTS) - a growing technique where attackers use platforms such as GitHub, Google Drive, Microsoft services and Telegram for command and control, malware delivery and data exfiltration.
We explore why this trend is growing, how it differs from Living Off the Land (LOTL)....and Lord of the Rings (LOTR)....why trusted services create new detection challenges, and what defenders should be monitoring.
Also in this episode:
Data centers in space, when physics still has to physics.
A USA vs UK Independence Day food showdown.
Hazel faces another round of Make Hazel a Hacker.
A new Reason Not to Quit looks at the latest successes from Operation Endgame.
Bill gets his own corner.
Here's the LOTS project repository mentioned in the episode https://lots-project.com/

AI is accelerating vulnerability discovery, so what impact is that having on defenders?
In this episode of Beers with Talos, Hazel, Bill, Joe, and Dave are joined by Nick Biasini to unpack what attackers are doing with AI-assisted vulnerability discovery, why local models rather than frontier models may be a more attractive route for them, and the vendors who are now drowning in a flood of bug reports (many of them junk) as AI sifts through decades of technical debt with nothing but time and patience.
We also kick things off with a listener question about threat trends and the FIFA World Cup, which leads to a discussion about whether any of us could resist Rickrolling the entire planet.
Also in this episode: Joe attempts to "Make Hazel a Hacker" and phish the Pope. Plus, we launch a new segment called “Reasons not to Quit” in which we celebrate defender wins.

Hazel, Dave and Joe plot to celebrate Bill's 25 years at Talos with stories and a good old fashioned roast.
The team also covers the latest security headlines, including AI-assisted vulnerability research, and why attackers still can’t resist abusing trusted systems (or Roblox).
They also break down the latest Cisco Talos Incident Response Quarterly Trends report, including:
Phishing’s return as the top initial access vector
AI-generated credential harvesting pages built in minutes
Crimson Collective activity and GitHub token exposure
Pre-ransomware incidents and early disruption
Why logging (still) matters more than ever
Read the full report at https://blog.talosintelligence.com/ir-trends-q1-2026/
And for more guidance for defenders, check out this episode of The Talos Threat Perspective https://www.youtube.com/watch?v=wppL7JBshK8
Plus: Crossbows, Metasploit nostalgia, and why, despite everything, security fundamentals still win.